CVE-2026-72471

A flaw was found in the NTFS3 filesystem driver in the Linux kernel. An uninitialized value vulnerability exists when processing NTFS3 filesystem operations. This can lead to a kernel crash, resulting in a denial of service (DoS) for the affected system. A local attacker could potentially exploit this by interacting with a specially crafted NTFS3 filesystem.

A moderate impact uninitialized-value flaw was found in the NTFS3 filesystem driver in the Linux kernel. When the target VCN being sought is not found within the run list, attr_data_get_block_locked() can exit prematurely without initializing the lcn variable in ni_seek_data_or_hole(), and the uninitialized value is subsequently used. A local attacker able to mount and interact with a specially crafted NTFS3 filesystem could exploit this flaw to crash the kernel, resulting in a denial of service. Red Hat Product Security has rated this flaw as Moderate because the flaw's technical evidence shows a local attack vector with availability-only impact; this differs from the upstream CVE record's Important rating, whose CVSS vector assumes a network attack vector with confidentiality and integrity impact that the available evidence does not support. All Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel offerings currently recorded for this flaw are marked not affected because the vulnerable code is not present in those products.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.